fix(CI): fetch molecule-ci scripts before running, add second checkout step

.github/workflows/validate-org-template.yml

@@ -9,12 +9,16 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        repository: Molecule-AI/molecule-ci
+        path: molecule-ci
+        ref: ${{ github.sha }}
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
           cache: "pip"
-          cache-dependency-path: .molecule-ci/scripts/requirements.txt
+          cache-dependency-path: molecule-ci/.molecule-ci/scripts/requirements.txt
       - run: pip install pyyaml -q
-      - run: python3 .molecule-ci/scripts/validate-org-template.py
+      - run: python3 molecule-ci/.molecule-ci/scripts/validate-org-template.py
       - name: Check for secrets
-        run: python3 scripts/check-secrets.py
+        run: python3 molecule-ci/.molecule-ci/scripts/check-secrets.py

.github/workflows/validate-plugin.yml

@@ -9,12 +9,16 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        repository: Molecule-AI/molecule-ci
+        path: molecule-ci
+        ref: ${{ github.sha }}
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
           cache: "pip"
-          cache-dependency-path: .molecule-ci/scripts/requirements.txt
+          cache-dependency-path: molecule-ci/.molecule-ci/scripts/requirements.txt
       - run: pip install pyyaml -q
-      - run: python3 .molecule-ci/scripts/validate-plugin.py
+      - run: python3 molecule-ci/.molecule-ci/scripts/validate-plugin.py
       - name: Check for secrets
-        run: python3 scripts/check-secrets.py
+        run: python3 molecule-ci/.molecule-ci/scripts/check-secrets.py

.github/workflows/validate-workspace-template.yml

@@ -9,15 +9,19 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        repository: Molecule-AI/molecule-ci
+        path: molecule-ci
+        ref: ${{ github.sha }}
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
           cache: "pip"
-          cache-dependency-path: .molecule-ci/scripts/requirements.txt
+          cache-dependency-path: molecule-ci/.molecule-ci/scripts/requirements.txt
       - run: pip install pyyaml -q
-      - run: python3 .molecule-ci/scripts/validate-workspace-template.py
+      - run: python3 molecule-ci/.molecule-ci/scripts/validate-workspace-template.py
       - name: Docker build smoke test
         if: hashFiles('Dockerfile') != ''
         run: docker build -t template-test . --no-cache 2>&1 | tail -5 && echo "✓ Docker build succeeded"
       - name: Check for secrets
-        run: python3 scripts/check-secrets.py
+        run: python3 molecule-ci/.molecule-ci/scripts/check-secrets.py